Skip to content

Commit 187f0f0

Browse files
committed
Some review suggestions.
1 parent 91ff02b commit 187f0f0

File tree

2 files changed

+25
-25
lines changed

2 files changed

+25
-25
lines changed

docs/bugs.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"uid": "SOL-2022-5",
44
"name": "DirtyBytesArrayToStorage",
55
"summary": "Copying ``bytes`` arrays from memory or calldata to storage may result in dirty storage values.",
6-
"description": "Copying ``bytes`` arrays from memory or calldata to storage is done in chunks of 32 bytes. Thereby, dirty values in calldata or memory can be written to storage, which may then become observable after a ``.push()`` on the bytes array in storage.",
6+
"description": "Copying ``bytes`` arrays from memory or calldata to storage is done in chunks of 32 bytes even if the length is not a multiple of 32. Thereby, extra bytes past the end of the array may be copied from calldata or memory to storage. These dirty bytes may then become observable after a ``.push()`` without arguments to the bytes array in storage, i.e. such a push will not result in a zero value at the end of the array as expected. This bug only affects the legacy code generation pipeline, the new code generation pipeline via IR is not affected.",
77
"link": "https://blog.soliditylang.org/2022/06/15/dirty-bytes-array-to-storage-bug/",
88
"introduced": "0.0.1",
99
"fixed": "0.8.15",
Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,28 @@
11
contract C {
2-
event ev0(uint[] i0, uint);
3-
bytes public s2;
4-
function h() external returns (bytes memory) {
5-
uint[] memory x = new uint[](2);
6-
emit ev0(x, 0x21);
7-
bytes memory m = new bytes(63);
8-
s2 = m;
9-
s2.push();
10-
return s2;
11-
}
12-
function g() external returns (bytes memory) {
13-
bytes memory m = new bytes(63);
14-
assembly {
15-
mstore8(add(m, add(32, 63)), 0x42)
2+
event ev(uint[], uint);
3+
bytes public s;
4+
function h() external returns (bytes memory) {
5+
uint[] memory x = new uint[](2);
6+
emit ev(x, 0x21);
7+
bytes memory m = new bytes(63);
8+
s = m;
9+
s.push();
10+
return s;
11+
}
12+
function g() external returns (bytes memory) {
13+
bytes memory m = new bytes(63);
14+
assembly {
15+
mstore8(add(m, add(32, 63)), 0x42)
16+
}
17+
s = m;
18+
s.push();
19+
return s;
20+
}
21+
function f(bytes calldata c) external returns (bytes memory) {
22+
s = c;
23+
s.push();
24+
return s;
1625
}
17-
s2 = m;
18-
s2.push();
19-
return s2;
20-
}
21-
function f(bytes calldata c) external returns (bytes memory) {
22-
s2 = c;
23-
s2.push();
24-
return s2;
25-
}
2626
}
2727
// ====
2828
// compileViaYul: also
@@ -32,6 +32,6 @@ contract C {
3232
// gas legacy: 731840
3333
// gas legacyOptimized: 494859
3434
// h() -> 0x20, 0x40, 0x00, 0
35-
// ~ emit ev0(uint256[],uint256): 0x40, 0x21, 0x02, 0x00, 0x00
35+
// ~ emit ev(uint256[],uint256): 0x40, 0x21, 0x02, 0x00, 0x00
3636
// g() -> 0x20, 0x40, 0, 0x00
3737
// f(bytes): 0x20, 33, 0, -1 -> 0x20, 0x22, 0, 0xff00000000000000000000000000000000000000000000000000000000000000

0 commit comments

Comments
 (0)